CVE-2013-6078

Severity Score

5.8

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The default configuration of EMC RSA BSAFE Toolkits and RSA Data Protection Manager (DPM) 20130918 uses the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm, which makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms by leveraging unspecified "security concerns," aka the ESA-2013-068 issue. NOTE: this issue has been SPLIT from CVE-2007-6755 because the vendor announcement did not state a specific technical rationale for a change in the algorithm; thus, CVE cannot reach a conclusion that a CVE-2007-6755 concern was the reason, or one of the reasons, for this change.

La configuración por defecto de EMC RSA BSAFE Toolkits y RSA Data Protection Manager (DPM) 20130918 utiliza el algoritmo Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG), lo que facilita a atacantes dependientes de contexto anular mecanismos de protección criptográfica mediante el aprovechamiento de 'temas de seguridad' no especificados, también conocido como el problema ESA-2013-068. NOTA: este problema ha sido dividido (SPLIT) de CVE-2007-6755 porque la declaración del proveedor no ofreció un razonamiento técnico especifico para un cambio en el algoritmo; por lo tanto, CVE no puede llegar a una conclusión que un tema de CVE-2007-6755 fue la razón, o una de las razones, para este cambio.

*Credits: N/A

CVSS Scores

NISTv2 5.8

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2013-10-11 CVE Reserved
2014-06-17 CVE Published
2023-03-07 EPSS Updated
2024-08-06 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-310: Cryptographic Issues

CAPEC

References (4)

URL	Tag	Source
http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers	X_refsource_misc
http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html	X_refsource_misc
http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655	X_refsource_confirm
http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect	X_refsource_misc

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Emc Search vendor "Emc"		Rsa Bsafe Toolkits Search vendor "Emc" for product "Rsa Bsafe Toolkits"				-		-		Affected
Emc Search vendor "Emc"		Rsa Data Protection Manager Search vendor "Emc" for product "Rsa Data Protection Manager"				20130918 Search vendor "Emc" for product "Rsa Data Protection Manager" and version "20130918"		-		Affected